CVE-2026-98563: net: phylink: record the PHY only once bringup cannot fail

In the Linux kernel, the following vulnerability has been resolved:

net: phylink: record the PHY only once bringup cannot fail

phylinkbringupphy() stores the PHY in pl->phydev before its last fallible step: on a MAC whose phylink ops implement LPI, phyeeerxclockstop() can fail with a real MDIO error. The callers unwind with phydetach(), which knows nothing about pl->phydev, so a pointer to a PHY that is no longer attached outlives the failed connect.

What that costs depends on how the caller got here. phylinkconnectphy() goes through phylinkattachphy(), which refuses to attach while pl->phydev is set, turning a transient MDIO error into a permanent -EBUSY. The SFP path is worse than that: sfpsmprobephy() answers the failure with phydeviceremove() and phydevicefree(), and it assigns sfp->modphy only past that error return, so nothing clears pl->phydev and it is left pointing at a freed phydevice that phylinkresolve() and the ethtool helpers go on reading. phylinkfwnodephyconnect() has no such check, so a later connect overwrites the stale pointer and hides the problem. A disconnect does not: phylinkdisconnectphy() hands that pointer to phydisconnect(), and the second phydetach() on the same PHY drops references the first one already released.

Found while making a DSA port survive a PHY whose driver arrives after the switch probes: keeping the port across a failed connect and retrying is what makes this window reachable.

Publish the pointer after the last call that can fail instead of unwinding it afterwards. Nothing between the two points reads pl->phydev, and the registration that follows cannot fail: phyrequestinterrupt() falls back to polling on its own. The PHY-side state keeps the order it had, so no MDIO operation moves relative to another.